AUDIT REPORT 

Audit of NRC’s Oversight of Licensees’ 

Nuclear Security Officers 

OIG-08-A-07 March 18, 2008 

All publicly available OIG reports(including this report) are accessible through 

NRC’s Web site at: 

http:/www.nrc.gov/reading-rm/doc-collections/insp-gen/ 
 March 18, 2008 

MEMORANDUM TO: Luis A. Reyes 

Executive Director for Operations 

FROM: Stephen D. Dingbaum /RA/ 

Assistant Inspector General for Audits 

SUBJECT: AUDIT OF NRC’S OVERSIGHT OF LICENSEES’ NUCLEAR 

SECURITY OFFICERS (OIG-08-A-07) 

Attached is the Office of the Inspector General’s (OIG) audit report titled, Audit of NRC’s 

Oversight of Licensees’ Nuclear Security Officers. 

The report presents the results of the subject audit. Agency comments provided at the 

exit conference on February 21, 2008, have been incorporated, as appropriate, into this 

report. 

Please provide information on actions taken or planned on each of the 

recommendations within 30 days of the date of this memorandum. Actions taken or 

planned are subject to OIG follow up as stated in Management Directive 6.1. 

We appreciate the cooperation extended to us by members of your staff during the 

audit. If you have any questions or comments about our report, please contact me at 

415-5915 or Beth Serepca, Team Leader, Security and Information Management Team, 

at 415-5911. 

Attachment: As stated 
Electronic Distribution

Frank P. Gillespie, Executive Director, Advisory Committee on Reactor 

 Safeguards/Advisory Committee on Nuclear Waste 

E. Roy Hawkens, Chief Administrative Judge, Atomic Safety and 

 Licensing Board Panel 

Karen D. Cyr, General Counsel 

John F. Cordes, Jr., Director, Office of Commission Appellate Adjudication 

William M. McCabe, Chief Financial Officer 

Margaret M. Doane, Director, Office of International Programs 

Rebecca L. Schmidt, Director, Office of Congressional Affairs 

Eliot B. Brenner, Director, Office of Public Affairs 

Annette Vietti-Cook, Secretary of the Commission 

Bruce S. Mallett, Deputy Executive Director for Reactor 

 and Preparedness Programs, OEDO 

Martin J. Virgilio, Deputy Executive Director for Materials, Waste, Research, 

 State, Tribal, and Compliance Programs, OEDO 

Darren B. Ash, Deputy Executive Director for Information Services 

 and Chief Information Officer, OEDO 

Vonna L. Ordaz, Assistant for Operations, OEDO 

Timothy F. Hagan, Director, Office of Administration 

Cynthia A. Carpenter, Director, Office of Enforcement 

Charles L. Miller, Director, Office of Federal and State Materials 

 and Environmental Management Programs 

Guy P. Caputo, Director, Office of Investigations 

Thomas M. Boyce, Director, Office of Information Services 

James F. McDermott, Director, Office of Human Resources 

R. William Borchardt, Director, Office of New Reactors 

Michael F. Weber, Director, Office of Nuclear Material Safety and Safeguards 

James T. Wiggins, Acting Director, Office of Nuclear Reactor Regulation 

Brian W. Sheron, Director, Office of Nuclear Regulatory Research 

Corenthis B. Kelley, Director, Office of Small Business and Civil Rights 

Roy P. Zimmerman, Director, Office of Nuclear Security and Incident Response 

Samuel J. Collins, Regional Administrator, Region I 

Victor M. McCree, Acting Regional Administrator, Region II 

James L. Caldwell, Regional Administrator, Region III 

Elmo E. Collins, Jr., Regional Administrator, Region IV 

 

 
Audit of NRC’s Oversight of Licensees’ Nuclear Security Officers 

i

EXECUTIVE SUMMARY 

BACKGROUND

Licensee Actions to Ensure Fitness and Competence of 

Security Officers

Licensees’ take various measures to ensure that their security 

officers are mentally and physically fit, professionally competent, 

and sufficiently trustworthy to carry out their duties at nuclear power 

plants. These measures are designed to comply with various NRC 

regulations governing employee conduct, health, and work 

requirements. 

NRC exercises oversight of licensees’ security officers primarily 

through the Reactor Oversight Process’s physical protection 

cornerstone. Managed by the Office of Nuclear Security and 

Incident Response (NSIR), this program includes baseline security 

and safeguards inspections. Regional staff also conduct oversight 

activities, such as special inspections initiated in response to 

specific problems or extraordinary events. Additionally, NRC also 

evaluates licensee security programs through force-on-force 

exercises which are designed to assess the capability of security 

personnel to execute security plans while protecting the facility 

against sabotage. 

PURPOSE

The audit objective was to assess NRC’s oversight of security 

officers employed by licensees to protect nuclear power plants. 

OIG’s work considered fitness-for-duty regulations in 10 CFR 26, as 

well as pertinent regulations in 10 CFR 73. 

RESULTS IN BRIEF

NRC staff conduct security oversight activities in accordance with 

agency standards; however: 

 Regulations for licensees’ behavioral observation programs lack 

detailed implementation guidance and are not integrated with 

guidance for related security programs. 

 Advance notification of all baseline security inspections could 

compromise the accuracy of NRC’s assessments of licensee 

fitness-for-duty performance. 
Audit of NRC’s Oversight of Licensees’ Nuclear Security Officers 

ii

Behavioral Observation Programs Lack Detailed Guidance and 

Are Not Integrated with Related Security Programs

NRC requires licensees to implement behavioral observation 

programs at nuclear power plants, but lacks an integrated 

regulatory framework for overseeing these programs. This occurs 

because behavioral observation program standards and 

implementation guidance exist in several forms of guidance that are 

not fully integrated. This compromises NRC’s oversight of licensee 

behavioral observation programs, thereby increasing security risks 

to nuclear power plants. 

Advance Notification of All Baseline Security Inspections 

Could Compromise NRC Assessments 

NRC routinely provides licensees advance notification of security 

inspections, even though agency policy does not preclude nonotice or short-notice inspections. This occurs because agency 

guidance directs staff to pre-announce inspections at operating 

power reactor sites to minimize the regulatory burden on licensees. 

As a result, inspections might not accurately capture the day-to-day 

operating conditions of licensee security programs, thereby 

increasing the risk that NRC might overlook evidence of systemic 

problems in these programs 

RECOMMENDATIONS

This report makes three recommendations. A consolidated list of 

these recommendations appears in Section V of this report. 

AGENCY COMMENTS

At an exit conference held on February 21, 2008, agency managers 

provided comments concerning the draft report. We modified this 

report in response to their comments, as we deemed appropriate. 

NRC reviewed these modifications and opted not to submit formal 

comments.
Audit of NRC’s Oversight of Licensees’ Nuclear Security Officers 

iii

ABBREVIATIONS AND ACRONYMS

BOP Behavioral Observation Program 

NRC U.S. Nuclear Regulatory Commission 

NSIR Office of Nuclear Security and Incident Response 

OGC Office of the General Counsel 

OIG Office of the Inspector General (NRC) 
Audit of NRC’s Oversight of Licensees’ Nuclear Security Officers 

iv

[Page intentionally left blank.] 
Audit of NRC’s Oversight of Licensees’ Nuclear Security Officers 

v

TABLE OF CONTENTS

EXECUTIVE SUMMARY.........................................................................i 

ABREVIATIONS AND ACRONYMS ..................................................... iii 

I. BACKGROUND .............................................................................1 

II. PURPOSE......................................................................................2 

III. FINDINGS......................................................................................3 

 A. OVERSIGHT OF LICENSEE BEHAVIORAL 

OBSERVATION PROGRAMS .........................................................4 

 B. ADVANCE NOTIFICATION OF SECURITY INSPECTIONS ....................8 

IV. AGENCY COMMENTS ................................................................10 

V. CONSOLIDATED LIST OF RECOMMENDATIONS ....................11 

APPENDIX

A. SCOPE AND METHODOLOGY...................................................13 
Audit of NRC’s Oversight of Licensees’ Nuclear Security Officers 

vi

[Page intentionally left blank.] 
Audit of NRC’s Oversight of Licensees’ Nuclear Security Officers 

1

I. BACKGROUND

Licensee Actions to Ensure Fitness and Competence of 

Security Officers

Licensees take various measures to ensure that their security 

officers are mentally and physically fit, professionally competent, 

and sufficiently trustworthy to carry out their duties at nuclear power 

plants. These measures are designed to comply with various NRC 

regulations governing employee conduct, health, and work 

requirements. For instance, licensees must review the 

backgrounds of prospective employees before granting them 

unescorted access to nuclear power plants.1

 Employees are 

subject to for-cause and random testing for alcohol and drug use.2 

In addition, licensees are required to implement behavioral 

observation programs to detect or prevent malicious conduct.3

These programs include mandatory awareness programs that train 

employees on identification and management of workplace 

behavior problems. Lastly, security personnel at nuclear power 

plants must pass routine medical exams and physical fitness tests4

, 

and undergo regular training in job-specific knowledge and skills 

such as rules for use of lethal force and weapons proficiency.5 

NRC Oversight of Licensee Security Officers

NRC exercises oversight of licensees’ security officers through the 

Reactor Oversight Process physical protection cornerstone. 

Managed by the Office of Nuclear Security and Incident Response 

(NSIR), this program includes baseline security and safeguards 

inspections. Through these inspections, NRC evaluates licensees’ 

implementation of agency security regulations at nuclear power 

plants. Security specialists assigned to NRC Regional Offices 

conduct inspections at nuclear power plants in accordance with 

agency guidance that prescribes the scope and frequency of 

inspections.6

 NRC inspectors carry out most baseline security 

inspections at each plant on a biennial basis.7

 Regional staff 

conduct other oversight activities, such as special inspections 

initiated in response to specific problems or extraordinary events. In 

 

1

 10 Code of Federal Regulations (CFR) 73.56 (b) (1) and (2) (I). 2

 10 CFR 26.24. 

3

 10 CFR 73.56 (b)(2) ((iii). 

4

 10 CFR 73-- Appendix B, I (B) and (C). 

5

 10 CFR 73-- Appendix B, II and III. 

6

 Inspection Procedure (IP) 71130. 

7

 Three inspection procedures in IP 71130 are performed annually, and one is performed 

triennially. 
Audit of NRC’s Oversight of Licensees’ Nuclear Security Officers 

2

addition, NRC resident inspectors assigned to power plants 

routinely observe licensee security personnel, and will assume 

additional duties as the agency implements new plans for 

expanding the role of resident inspectors in security oversight. 

Figure 1: Security personnel participating in weapons training. 

NRC further evaluates licensee security programs through triennial 

force-on-force exercises. These exercises test the ability of 

security personnel at each nuclear power plant to execute security 

plans and protect facilities against sabotage.8 Force-on-force 

exercises are part of the baseline security inspection program.9

 

II. PURPOSE 

The objective of this audit was to assess NRC’s oversight of 

security officers employed by licensees to protect nuclear power 

plants. OIG’s work considered fitness-for-duty regulations in 10 

CFR 26, as well as pertinent regulations in 10 CFR 73. Due to an 

ongoing OIG investigation, this audit does not address the agency’s 

allegations program. Appendix A contains information on the audit 

scope and methodology. 

 

8

 In 2006, OIG conducted a Special Inquiry examining NRC’s efforts to ensure that force-on-force 

exercises adequately test nuclear power plant defensive capabilities. OIG determined that 

advance distribution of exercise schedules to individuals without a need to know can compromise 

the security of this information. “NRC’s Oversight of the Force-on-Force Program,” Case No. 05-

01S, May 1, 2006. 

9

 Force-on-force inspection procedures are listed in IP 71130.03, “Contingency Response—

Force-on-Force Testing.” 
Audit of NRC’s Oversight of Licensees’ Nuclear Security Officers 

3

III. FINDINGS 

In 2007, NRC concluded a rulemaking for 10 CFR 26 that 

introduced new work hour controls for personnel at nuclear power 

plants, aligned agency drug testing protocols with those used 

throughout the federal government, and integrated special 

guidance for security personnel with agency regulations applicable 

to all personnel employed at nuclear power plants.10 In addition, a 

rulemaking that would amend security regulations in 10 CFR 73, 

was ongoing at the time of this audit. According to agency officials, 

these rulemaking efforts address behavioral observation program 

regulations and align them with regulations for licensee access 

authorization and fitness-for-duty programs. OIG auditors found 

that NRC staff conducted security oversight activities in accordance 

with agency standards. However, auditors found two issues that 

NRC management should address to improve agency performance, 

specifically: 

 Regulations for licensees’ behavioral observation programs lack 

detailed implementation guidance and are not integrated with 

guidance for related security programs. 

 Advance notification of all baseline security inspections could 

compromise the accuracy of NRC’s assessments of licensee 

fitness-for-duty performance. 

By enhancing behavioral observation program oversight and 

incorporating limited-scope, short-notice inspections into the 

baseline security inspection program, NRC can improve its 

oversight of licensees’ security officers. 

 

10 On April 17, 2007, the Commission approved new fitness-for-duty rules amending 10 CFR 26, 

and instructed staff to develop accompanying implementation guidance for licensees. 
Audit of NRC’s Oversight of Licensees’ Nuclear Security Officers 

4

A. Oversight of Licensee Behavioral Observation Programs 

 Behavioral Observation Programs Lack Detailed Guidance and 

Are Not Integrated with Related Security Programs 

NRC requires licensees to implement behavioral observation 

programs at nuclear power plants, but lacks an integrated 

regulatory framework for overseeing these programs. This occurs 

because behavioral observation program standards and 

implementation guidance exist in several forms of guidance that are 

not fully integrated. This compromises NRC’s oversight of licensee 

behavioral observation programs, thereby increasing security risks 

to nuclear power plants.

Key Features of Behavioral Observational Programs

NRC staff consulted with U.S. Department of Defense subject 

matter experts to identify features of effective behavioral 

observation programs. Through this work, agency staff have 

determined that licensees’ programs should have the following 

elements:11

• Professional management. Behavioral observation 

programs require licensee personnel to make judgments 

about an individual’s mental health and potential for 

malicious behavior. However, only mental health specialists 

are professionally qualified to make such judgments and 

recommend measures for dealing with psychologically unfit 

employees. 

• Standardized procedural guidance. Behavioral observation 

programs should have clear standards for determining 

whether an employee’s trustworthiness and reliability are 

compromised. These standards should further prescribe 

actions to be taken by licensees if employees are deemed 

unfit for duty. 

• Integration with plant security. Behavioral observation 

programs must be integrated with other programs, such as 

access authorization, that are designed to mitigate threats 

posed by psychologically unfit employees. 

 

11 Agency officials told OIG that the ongoing 10 CFR 73 rulemaking addresses these issues. 
Audit of NRC’s Oversight of Licensees’ Nuclear Security Officers 

5

Behavioral Observation Program Regulations

NRC lacks an integrated regulatory framework for overseeing 

licensees’ behavioral observation programs. In particular, NRC 

needs to strengthen its regulations for professional qualification and 

implementation standards, and integrate behavioral observation 

program regulations with related security regulations. 

Professional Qualifications

 

NRC’s regulations regarding licensee behavioral observation 

programs are not prescriptive. The regulations do not prescribe 

mental health qualification standards for program staff, nor does the 

agency define staff roles and responsibilities. For example, a 

behavioral observation program manager could lack experience or 

formal training in mental health, and could also be responsible for 

other programs. In contrast, agency regulations governing drug 

and alcohol testing prescribe professional requirements for licensee 

personnel and contractors responsible for administering tests. 

Procedural Guidance

Agency regulations also do not specify how licensees should 

manage employees whose behavior raises trustworthiness or 

reliability concerns.12 NRC security guidance issued in 2004 

advises licensees on “for-cause” psychological evaluations in 

response to aberrant behavior. Nevertheless, this guidance does 

not define conditions that would warrant an evaluation and, as 

advisory guidance, lacks the regulatory force of CFR rules. In 

contrast, CFR sections governing drug and alcohol use explicitly 

require for-cause testing of employees who appear to be impaired, 

and require that such employees be relieved from duty with 

suspended site access pending test results. Further, licensees 

must develop Employee Assistance Program action plans for 

employees who test positive for first-time drug and alcohol 

offenses; repeat violations can automatically trigger revocation of 

employees’ site access clearance.13 

Program Integration

Behavioral observation program regulations are not explicitly linked 

to other CFR sections governing fitness-for-duty and access 

authorization. These programs are inherently related, and thus, 

must be implemented in tandem to assure plant security. If 

 

12 10 CFR 73.56. 

13 10 CFR 26.27. 
Audit of NRC’s Oversight of Licensees’ Nuclear Security Officers 

6

integrated, these programs provide a comprehensive framework for 

identifying personnel who might pose a security threat and 

preventing or mitigating harm these personnel might cause. 

Figure 2 illustrates how behavioral observation programs fit into a 

comprehensive framework for safeguarding nuclear power plants. 

Source: OIG analysis. 

Figure 2: Behavioral observation programs work in tandem with other security programs 

as part of a defense-in-depth approach to safeguarding nuclear power plants. 

Inconsistent Regulations 

NRC lacks assurance that its behavioral observation program 

regulations ensure nuclear power plant security because these 

regulations lack detailed programmatic criteria and are insufficiently 

integrated with related CFR sections. Specifically, agency 

regulations do not explicitly state NRC’s expectations of licensees 

in the development and implementation of behavioral observation 

programs for security personnel. Moreover, the language of current 

regulations does not explicitly explain how behavioral observation 

programs fit into the broader context of licensee programs and 

agency regulations designed to ensure that licensee security 

personnel are fit for duty, such as access authorization. 

PREVENTION 

Access 

Authorization 

programs 

prevent malicious 

behavior by 

denying site access 

rights to 

untrustworthy and 

unreliable persons. 

DETECTION 

Behavioral 

Observation and 

Fitness-for-Duty 

programs detect

threats posed by 

personnel with siteaccess before they 

can commit hostile 

acts. 

DENIAL 

Physical protection 

measures deny

malicious and 

psychological unfit 

persons 

opportunities to 

harm others or 

damage facilities. 

Access to Site Access to Means Access to Target 

Insider Threat Mitigation: Defense-in-Depth 
Audit of NRC’s Oversight of Licensees’ Nuclear Security Officers 

7

Security Implications 

Without clear and well-integrated behavioral observation program 

regulations, NRC and its licensees might not identify program 

deficiencies that could jeopardize nuclear power plant security and 

public safety. During 2007, for example, a plant security manager 

reportedly noticed that an officer seemed too distressed to work, 

and relieved the officer from duty. Additionally, according to NRC 

analysis of an incident occurring at a different plant in early 2007, a 

licensee medical officer relieved an employee on the basis of 

aberrant behavior but, in accordance with plant procedures, did not 

suspend the employee’s site access rights.14 In both cases, the 

expelled employees later committed murder and/or suicide. NRC 

staff familiar with these cases commented that licensees’ 

behavioral observation programs functioned properly to the extent 

that unfit employees did not harm their respective plants. However, 

the staff remarked that these outcomes could have been incidental. 

In both cases, psychologically unfit employees retained some level 

of access to their respective plants after being relieved from duty, 

and thus, could have damaged plant facilities or harmed coworkers. 

Without regulations specifying how licensees should manage unfit 

personnel in the broader context of plant security, NRC risks 

diminished ability to identify deficiencies in licensees’ programs and 

pursue corrective actions. Such deficiencies could undermine 

licensees’ efforts to protect their facilities in accordance with site 

security plans. 

Recommendations

OIG recommends that the Executive Director for Operations: 

1. Revise regulations governing licensee behavioral 

observation programs to include specific criteria, such as 

program staff qualifications and procedures for managing 

unfit personnel. 

2. Integrate behavioral observation program regulations with 

access authorization regulations in ongoing Part 73 

rulemaking. 

 

14 The medical officer was not a mental health professional, but referred the employee to his 

personal doctor for care. OIG does not question this decision. Rather, OIG cites this incident to 

illustrate that medical officers without mental health care qualifications can find themselves in 

situations requiring them to make critical judgments about an employee’s mental health, and that 

actions taken to help an employee with mental health problems do not automatically “trigger” 

suspension of site access.
Audit of NRC’s Oversight of Licensees’ Nuclear Security Officers 

8

B. Advance Notification of Security Inspections 

NRC routinely provides licensees advance notification of security 

inspections, even though agency policy does not preclude nonotice or short-notice inspections. This occurs because agency 

guidance directs staff to pre-announce inspections at operating 

power reactor sites to minimize the regulatory burden on licensees. 

As a result, inspections might not accurately capture the day-to-day 

operating conditions of licensee security programs, thereby 

increasing the risk that NRC might overlook evidence of systemic 

problems in these programs. 

Inspection Guidance 

NRC guidance advises staff to provide licensees advance 

notification of upcoming inspections, but does not preclude short 

notice inspections. Advance notification may be made by a written 

communication, telephone call, or other communication as long as 

the information is communicated to the appropriate level of 

management in the licensee’s organization. Additionally, the 

advance notice should include the approximate date, broad subject 

area, and type of inspection planned. Depending on the type of 

inspection (routine, reactive or major activity) NRC staff are 

expected to provide this information 1-9 months before the 

inspection occurs. Nevertheless, Inspection Manual Chapter (IMC) 

0300, Announced and Unannounced Inspections, 15 states that 

“...each inspection shall be announced (with the exception of those 

performed by the resident inspectors) except when announcing the 

inspection could reasonably compromise the objectives of the 

inspectors.” 16

Security Inspection Notification 

In accordance with agency guidance, NRC notifies licensees of 

upcoming security inspections to facilitate the work of inspectors 

and plant personnel. These notifications do not provide detailed 

inspection plans. Nevertheless, NRC staff inspect physical 

protection program areas in regular one-, two-, or three-year cycles, 

which lends itself to licensees sharing information about how NRC 

teams conduct inspections. Several inspectors commented that 

NRC could mitigate the predictability inherent in its inspection policy 

through limited-scope, short notice inspections. This approach 

could be used without adversely impacting licensees because NRC 

can evaluate some security program areas with minimal licensee 

 

15 Inspection Manual Chapter (IMC) 0300, p. 1. 16 Italics added for emphasis. 
Audit of NRC’s Oversight of Licensees’ Nuclear Security Officers 

9

support. For instance, NRC inspectors could observe security 

personnel controlling access to plants and protected areas within 

plants. Inspectors could also “spot check” plant security personnel 

to ensure that they are alert and adequately trained to carry out 

their duties, which include searching vehicles and personnel for 

weapons and other contraband. 

 

Limited-scope, short-notice inspections could positively affect 

management culture at nuclear power plants by fostering 

accountability for employee fitness and workplace behavior. NRC 

has attributed some recent cases of security officer misconduct at 

nuclear power plants, in part, to deficient management cultures that 

overlooked or failed to deal with misconduct. Knowing that NRC 

might detect such problems through short-notice inspections, 

licensee managers would have considerable incentive to ensure 

that their personnel are fit for duty at all times. 

Agency Emphasis 

NRC does not use the policy flexibility to conduct ad hoc 

inspections because of agency emphasis on minimizing the 

regulatory burden on licensees. Agency guidance explicitly states 

that advance notification helps NRC and the licensee coordinate 

inspection activities and site operations, particularly through 

planning that considers licensee operations schedules and 

personnel availability.17 Additionally, NRC’s FY 2000-2005 

performance goal to reduce unnecessary regulatory burden on 

licensees18 underpins the agency’s policy for providing advance 

notification of activities at nuclear power reactor sites. 

Benefits of Short-Notice Security Inspections 

By routinely providing advance notice of inspections, the agency 

may not accurately capture the day-to-day security conditions at 

nuclear power plants. Advance notification enables licensees to 

share information about NRC inspection activities such as the 

inspection agenda and inspectors’ information requirements. 

This, in turn increases the risk that inspectors might not detect 

security problems, or that licensees might fix problems superficially 

for inspection purposes without solving the underlying causes of 

those problems. 

 

17 IMC 0300. 

18 SECY-02-0081. 
Audit of NRC’s Oversight of Licensees’ Nuclear Security Officers 

10

In contrast, limited-scope, short-notice security inspections would 

reduce the predictability of cyclical inspections and increase NRC’s 

visibility over day-to-day operations at licensees’ facilities. The 

agency administers random drug tests to its own employees to 

achieve similar objectives, as well as for the inherent deterrent 

effect of random, short-notice testing. Likewise, special inspections 

launched in response to allegations of security breaches and officer 

misconduct at nuclear power plants have revealed management 

problems that baseline security inspections did not detect. While 

limited scope, short-notice inspections would not eliminate licensee 

negligence or malfeasance, they would discourage it by increasing 

the likelihood of detection and sanction. This, in turn, would give 

NRC greater assurance that licensees are adequately securing 

their facilities between baseline inspections. 

Recommendation 

OIG recommends that the Executive Director for Operations:

3. Incorporate short-notice, limited-scope inspections to the 

baseline security inspection program. 

IV. AGENCY COMMENTS 

At an exit conference held on February 21, 2008, agency managers 

provided comments concerning the draft report. We modified the 

report in response to the comments, as we deemed appropriate. 

NRC reviewed these modifications and opted not to submit formal 

comments. 
Audit of NRC’s Oversight of Licensees’ Nuclear Security Officers 

11

V. CONSOLIDATED LIST OF RECOMMENDATIONS 

OIG recommends that the Executive Director for Operations: 

1. Revise regulations governing licensee behavioral 

observation programs to include specific criteria, such as 

program staff qualifications and procedures for managing 

unfit personnel. 

2. Integrate behavioral observation program regulations with 

access authorization regulations in ongoing Part 73 

rulemaking. 

3. Incorporate short-notice, limited-scope inspections to the 

baseline security inspection program. 
Audit of NRC’s Oversight of Licensees’ Nuclear Security Officers 

12

[Page intentionally left blank.] 
Audit of NRC’s Oversight of Licensees’ Nuclear Security Officers 

13

Appendix A 

SCOPE AND METHODOLOGY 

The OIG audit team reviewed relevant federal regulations, including 

fitness-for-duty provisions under 10 CFR 26, and pertinent 

regulations under 10 CFR 73. In addition, OIG reviewed internal 

agency criteria such as NRC inspection and training procedures, 

and Commission guidance. 

Auditors interviewed headquarters staff in the Office of Nuclear 

Security and Incident Response; the Office of the General Counsel; 

the Office of Enforcement; and the Office of Nuclear Reactor 

Regulation to learn about their roles and responsibilities with 

respect to oversight of licensee security personnel. Auditors also 

interviewed security inspectors and allegations coordinators in 

Regions I, II, III, and IV to assess their views on relevant oversight 

processes, and to determine if their activities are conducted in 

accordance with program requirements. 

Auditors observed a force-on-force exercise at Diablo Canyon 

Power Plant, and a relevant portion of a baseline security 

inspection at Millstone Power Station. Auditors interviewed security 

officers and licensee staff to obtain their insights on NRC’s 

oversight of security programs at these locations. 

This work was conducted from June 2007 through 

November 2007, in accordance with generally accepted 

government auditing standards. Those standards require that we 

plan and perform the audit to obtain sufficient, appropriate evidence 

to provide a reasonable basis for our findings and conclusions 

based on our audit objectives. We believe that the evidence 

obtained provides a reasonable basis for our findings and 

conclusions based on our audit objectives. The work was 

conducted by: Beth Serepca, Team Leader; Judy Gordon, Audit 

Manager; Paul Rades, Senior Analyst; and Jaclyn Storch, 

Management Analyst.